help, rpc terminating forcing shutdown
 

recently i have been getting errors forcing a shutdown because my "remote procedure call (rpc) was terminated unexpectedly" :\ what do i do? ran adaware and virus scan, nothing.

maybe something to do with this?

Boot into safemode with networking and download this patch linked from this page. Reboot into normal safemode without networking and apply the patch.

I just fixed that problem myself this morning, I was getting the countdown every time I booted and was getting really pissed off. I haven't seen the message since.

There is a worm circulating around now that exploits this. I agree, patch yourself at microsoft's site. There will be more worms in the future (the current worm has already been halted because it used a distribution site that has been taken offline).

Something new everyday eh

http://microsoft.com/downloads/detai...displaylang=en download that

Same thing started happening to me today. I'll try the patch when I get home - hope it works. Is it F8 to get boot options in XP :D?

I was trying to figure the problem out earlier, and I noticed a new program listed in the processes. It was called msblast.exe and was located in my windows/system32/ folder. Does anyone have any idea what this is? I have tried every search engine and came up empty. I shut it down, and it automatically restarted a few minutes later - then my comp proceed to keep crashing with the RPC failure. I was wondering if that maybe the worm exploiting the security hole.

Yes, msblast.exe is the worm

http://us.mcafee.com/virusInfo/defau...virus_k=100547

By the way, from what I said before ... about how it only used a select few distribution sites .. apparently this is changing according to reports from some AV company workers. Noone really knows for *sure* yet though.

As referenced above, download the RPC patch from Microsoft.

But really, you should never have had this issue, if you'd kept on top of things. Make sure you go hit WindowsUpdate.com and download all of the latest updates. Microsoft releases security patches for a reason, and it's not because they like making you download files.

Just wanted to say thanks to Bermuda, dude, and flippy. My system has now been up for 2 hours without crashing. Woohoo!! :D

My Windows Update stopped working for reasons I would not like to list ;)

I got nailed by this worm last night as well.

AND that was with an up-to-date virus file, but I didn't yet install the MS patch.

Oh well.

If anyone is still suffering from this little bastard, Symantic has put out this nifty REMOVAL TOOL for it.

After you follow the directions, PATCH!!!

Well even though you get the patch there is still a virus on your system which hackers could utilise whenever you're on the net, go to this website for instructions on how to get rid of it - http://securityresponse.symantec.com...oval.tool.html)[url]

Yep it got me. When it trys to shutdown go to
Start then Run and type in shutdown /a
This will stop your computer shutting down. Then do the following.

1. go to task manager and kill "msblast.exe"
2. do a search for "msblast" and delete the two files that show up.
3. Go to "Run" and type "regedit", delete the key "windows auto update" = msblast.exe " from
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run
4.Download the patch from "http://www.microsoft.com/technet/security/bulletin/MS03-026.asp"

5.reboot, install the patch, reboot, and enjoy.
Seems to be working so far.

To which I'll add: many who've had problems patching or removing the worm have found that installing (even temporarily) a client-side firewall like ZoneAlarm (freely downloadable) have found they can apply the patch once ZA stops the worm from using the affected ports.

Details here: http://www.microsoft.com/technet/tre...n/ms03-026.asp

hfnetchk and Windows Update are your friends! (believe it or not) :D

keep those boxes patched!